filenameeexomi.exe
size9804800 (0x959c00)
md5171abff01e39381ec267dbc79452ce14
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Packed.Vmprotect-6762068-1 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x140

Rich Header

lib idversiontimes used
2592671521
26126715192
156212022
2612810635
259281061
260267061
257262132
123507272
257242152
2602790517
259279059
26127905155
2602671526
2572671527
10332
2652810679
256281061
255281061
258281061

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections8
TimeDateStamp0x5df5d208
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x23
Magic0x20b
LinkerVersion14.23
SizeOfCode0x115e00
SizeOfInitializedData0x74000
SizeOfUninitializedData0
AddressOfEntryPoint0x12f354d
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x130e000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x115ce00R-X CODE
.rdata0x1170000x5456c0x54600R-- IDATA
.data0x16c0000x109cc0RW- IDATA
.pdata0x17d0000xc5b80R-- IDATA
_RDATA0x18a0000x940R-- IDATA
.vmp00x18b0000x87cb840R-X CODE IDATA
.vmp10xa080000x904f340x905000R-X CODE IDATA
.rsrc0x130d0000x1d50x200R-- IDATA

Data Directory

typevasize
EXPORT0xa25c000x1df4
IMPORT0xa11eb80x190
RESOURCE0x130d0000x1d5
EXCEPTION0x12fdd000xf234
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x12661800x28
LOAD_CONFIG0x12fdbf00x108
Bound_IAT00
IAT0xa2a0000x1c0
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x1401546780x1401546800x140175ce8000x300000
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dllGetVersionExW
USER32.dllEmptyClipboard
ADVAPI32.dllRegEnumValueW
SHELL32.dllSHGetSpecialFolderPathA
ntdll.dllRtlLookupFunctionEntry
WININET.dllHttpOpenRequestA
IMM32.dllImmSetCompositionWindow
WS2_32.dll115
d3d9.dllDirect3DCreate9
urlmon.dllURLDownloadToFileA
ole32.dllCoCreateInstance
d3dx9_43.dllD3DXCreateTextureFromFileExA
SHLWAPI.dllSHDeleteKeyW
WTSAPI32.dllWTSSendMessageW
KERNEL32.dllGetCurrentProcess
USER32.dllCharUpperBuffW
ADVAPI32.dllRegQueryValueExA
KERNEL32.dllLocalAlloc
KERNEL32.dllGetCurrentProcess
KERNEL32.dllGetCurrentThread
KERNEL32.dllLocalFree
KERNEL32.dllGetModuleFileNameW
KERNEL32.dllGetProcessAffinityMask
KERNEL32.dllSetProcessAffinityMask
KERNEL32.dllSetThreadAffinityMask
KERNEL32.dllSleep
KERNEL32.dllExitProcess
KERNEL32.dllGetLastError
KERNEL32.dllFreeLibrary
KERNEL32.dllLoadLibraryA
KERNEL32.dllGetModuleHandleA
KERNEL32.dllGetProcAddress
ADVAPI32.dllOpenSCManagerW
ADVAPI32.dllEnumServicesStatusExW
ADVAPI32.dllOpenServiceW
ADVAPI32.dllQueryServiceConfigW
ADVAPI32.dllCloseServiceHandle
ordentry_vafunction_name
10x7d5c0??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z
20x8d260??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z
30x85880??0HostRuntime@asmjit@@QEAA@XZ
40x859e0??0JitRuntime@asmjit@@QEAA@XZ
50x85840??0Runtime@asmjit@@QEAA@XZ
60x858c0??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z
70x82960??0VMemMgr@asmjit@@QEAA@PEAX@Z
80x85d10??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z
90x8d5b0??0Zone@asmjit@@QEAA@_K@Z
100x7d640??1Assembler@asmjit@@UEAA@XZ
110x8d2b0??1CodeGen@asmjit@@UEAA@XZ
120x85870??1HostRuntime@asmjit@@UEAA@XZ
130x85a80??1JitRuntime@asmjit@@UEAA@XZ
140x85870??1Runtime@asmjit@@UEAA@XZ
150x85870??1StaticRuntime@asmjit@@UEAA@XZ
160x829d0??1VMemMgr@asmjit@@QEAA@XZ
170x85db0??1X86Assembler@asmjit@@UEAA@XZ
180x8d5d0??1Zone@asmjit@@QEAA@XZ
190x67340??_FVMemMgr@asmjit@@QEAAXXZ
200x8d700?_alloc@Zone@asmjit@@QEAAPEAX_K@Z
210x864f0?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z
220x7d800?_grow@Assembler@asmjit@@QEAAI_K@Z
230x8d3f0?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z
240x7da60?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z
250x7db30?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ
260x13d5b0?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B
270x7d980?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z
280x86390?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z
290x7d8e0?_reserve@Assembler@asmjit@@QEAAI_K@Z
300x8d520?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z
310x1411b0?_x86CondToCmovcc@asmjit@@3QBIB
320x141250?_x86CondToJcc@asmjit@@3QBIB
330x141200?_x86CondToSetcc@asmjit@@3QBIB
340x13d5c0?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B
350x13f030?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B
360x141160?_x86ReverseCond@asmjit@@3QBIB
370x85af0?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z
380x858f0?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z
390x86040?align@X86Assembler@asmjit@@UEAAIII@Z
400x82ad0?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z
410x81d20?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z
420x81dc0?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z
430x8d7e0?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z
440x7dba0?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z
450x95800?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z
460x95820?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z
470x8fd80?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ
480x8d840?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z
490x7dcd0?embed@Assembler@asmjit@@UEAAIPEBXI@Z
500x85ee0?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z
510x7de30?emit@Assembler@asmjit@@QEAAII@Z
520x7dea0?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z
530x7e110?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z
540x7e170?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z
550x7de80?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z
560x7e050?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z
570x7e0b0?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z
580x7de60?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z
590x7df90?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z
600x7dff0?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z
610x7ded0?emit@Assembler@asmjit@@QEAAIIH@Z
620x7df30?emit@Assembler@asmjit@@QEAAII_K@Z
630x79d0?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z
640x858b0?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ
650x8fdc0?getHost@CpuInfo@asmjit@@SAPEBU12@XZ
660x81d00?getPageGranularity@VMemUtil@asmjit@@SA_KXZ
670x81ce0?getPageSize@VMemUtil@asmjit@@SA_KXZ
680x1a540?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ
690x7dd90?make@Assembler@asmjit@@UEAAPEAXXZ
700x13d5a0?noOperand@asmjit@@3UOperand@1@B
710x85c00?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z
720x85bd0?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z
730x85bc0?release@JitRuntime@asmjit@@UEAAIPEAX@Z
740x1df0?release@StaticRuntime@asmjit@@UEAAIPEAX@Z
750x82be0?release@VMemMgr@asmjit@@QEAAIPEAX@Z
760x81e60?release@VMemUtil@asmjit@@SAIPEAX_K@Z
770x81ea0?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z
780x7dd60?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z
790x7d730?reset@Assembler@asmjit@@QEAAX_N@Z
800x8d3a0?reset@PodVectorBase@asmjit@@QEAAX_N@Z
810x82a20?reset@VMemMgr@asmjit@@QEAAXXZ
820x8d650?reset@Zone@asmjit@@QEAAX_N@Z
830x8d8c0?sdup@Zone@asmjit@@QEAAPEADPEBD@Z
840x85dc0?setArch@X86Assembler@asmjit@@QEAAII@Z
850x8d2f0?setError@CodeGen@asmjit@@QEAAIIPEBD@Z
860x8d350?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z
870x8d970?sformat@Zone@asmjit@@QEAAPEADPEBDZZ
880x82db0?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z
890x13c750?x86RegData@asmjit@@3UX86RegData@1@B
900
d1 2d d8 c6 ef fe bf d9  ca 75 11 fa 9b 96 54 7c  |.-.......u....T||
65 37 c4 c6 68 dd 39 64  1a 2f 5e a3 ca db 15 d8  |e7..h.9d./^.....|
e3 20 79 08 89 bc 7b f3  7c 1e 91 55 7f 79 5b c1  |. y...{.|..U.y[.|
ac 21 48 8c 72 59 15 94  29 69 b6 d8 7b b9 8a 40  |.!H.rY..)i..{..@|
07 33 cf ea 7d 2f d2 8f  ae bb 52 98 aa ee ef 1e  |.3..}/....R.....|
f8 17 4c e0 1a 0b 97 73  40 53 2d aa 70 02 13 f6  |..L....s@S-.p...|
95 6b 69 61 95 17 a6 2b  81 11 2a de f9 03 88 c6  |.kia...+..*.....|
cb 39 91 22 ed ec f3 0b  5f 88 8e 57 0a b9 3c 7b  |.9."...._..W..<{|
b5 04 bb b0 21 27 f8 dd  56 93 56 90 4c 36 44 84  |....!'..V.V.L6D.|
e8 da 3d fe fd 6c ff 79  cb 5a 86 75 28 dd b2 e2  |..=..l.y.Z.u(...|
c9 e8 1d f3 f2 08 f2 cc  d5 ed 77 6c 07 7e e2 b6  |..........wl.~..|
58 03 da 7b 5e ec b3 f0  10 cd a8 eb 30 5c c9 d2  |X..{^.......0\..|
fe 3b 47 97 e0 54 61 b6  e9 fe 91 06 8f c4 c8 4c  |.;G..Ta........L|
e6 6d 54 6e a8 43 2f 38  f8 1b 6b f9 8c 19 79 07  |.mTn.C/8..k...y.|
42 51 dc dd 46 9e 32 6a  c2 d9 8b 44 53 65 ff 4b  |BQ..F.2j...DSe.K|
23 0b fc 85 f8 39 b2 2a  16 ad 2a ae 2a 6a 5c 4f  |#....9.*..*.*j\O|
45 b5 5f db 81 e8 7a 4d  53 c5 34 61 40 32 b5 4d  |E._...zMS.4a@2.M|
63 7d 8b be ef 0e a5 33  bd a6 21 ee 7c 9b b0 8e  |c}.....3..!.|...|
ff a4 b6 7d f3 ab 72 56  52 3a 3b 6b cb ee b9 7f  |...}..rVR:;k....|
bd 9c 16 ee 31 f2 11 d7  8a 5b f4 74 f6 eb 59 3c  |....1....[.t..Y<|
2a 10 ad fd 87 53 f3 93  3a 68 b4 c7 ec d6 01 22  |*....S..:h....."|
8f 75 9d bd 67 8d 22 ac  57 d3 2a cb 14 0d dd 62  |.u..g.".W.*....b|
43 9d 74 f1 24 bf 02 a3  4b b1 19 2a 1f 94 25 0d  |C.t.$...K..*..%.|
79 c5 80 a5 3e 79 ac dc  c5 cb ac 55 52 a8 68 a1  |y...>y.....UR.h.|
8d 26 9d 3c b8 46 3e 3b  09 ac c5 1f e0 ca 62 a6  |.&.<.F>;......b.|
dd 02 06 f8 e5 c2 25 26  3c 34 ca 45 33 d6 c8 2d  |......%&<4.E3..-|
8f b7 22 18 39 ab 71 22  b9 a4 f8 04 38 0e 1a ed  |..".9.q"....8...|
e5 d1 57 59 94 ec a5 db  e1 b2 b4 25 3a a8 71 4c  |..WY.......%:.qL|
12 14 5b 92 9b 2f 07 b6  69 97 58 0e ab 66 52 72  |..[../..i.X..fRr|
fd 0f 81 3f 80 6c 6c 62  a6 9f 83 d1 f3 20 f9 5a  |...?.llb..... .Z|
a3 30 0a 0f d9 fe 0f e6  65 b8 6d c2 46 d2 31 5c  |.0......e.m.F.1\|
56 cc f5 76 68 ad da 35  b8 85 b0 fb 6c b4 9b 46  |V..vh..5....l..F|
17 b5 d1 c1 72 40 bd b7  43 6c 22 fb 98 c2 05 62  |....r@..Cl"....b|
63 4a 0a 9f 0d 8c 77 e3  8e a6 1a a8 36 d1 36 92  |cJ....w.....6.6.|
03 03 38 b4 6a 89 6a 42  d8 cf 48 e8 b5 9c 40 d3  |..8.j.jB..H...@.|
5b 82 f6 2c 31 dc eb 0d  e1 77 03 af 65 d5 cd 57  |[..,1....w..e..W|
bf a8 2b 46 45 68 92 b2  41 b0 95 8d b5 b7 f4 10  |..+FEh..A.......|
bc 1f 5a e5 9e e1 86 ea  30 a0 91 3e 14 93 07 40  |..Z.....0..>...@|
6d eb 77 a7 11 dc d3 48  5b 10 a0 be b4 e1 5e 8c  |m.w....H[.....^.|
c6 01 b5 69 a1 d9 38 46  b7 7c 4f d5 62 d2 ae 8c  |...i..8F.|O.b...|
6c c7 53 de 59 d9 73 d7  4c 26 e4 a9 d0 5c 57 54  |l.S.Y.s.L&...\WT|
7c 39 6e 23 0c 6e 17 7c  81 9f ac ca ee 4e 33 0e  ||9n#.n.|.....N3.|
64 68 54 45 b1 48 59 4a  f7 dc c5 ca af dc e2 83  |dhTE.HYJ........|
a8 91 cd d9 31 c4 5e 80  d3 ca 79 c5 df b4 26 2d  |....1.^...y...&-|
bd af 75 8a b1 03 90 9a  8c 53 85 f5 f6 0b 25 ca  |..u......S....%.|
54 06 82 a4 ea 71 6a d8  bd 78 ed 44 60 2a c0 e6  |T....qj..x.D`*..|
a8 b3 97 2e f3 5b 4a d9  77 db 4d 52 53 04 66 ef  |.....[J.w.MRS.f.|
d2 44 9b 6e 15 fd 3e 20  0f d4 24 15 9d c4 5c 47  |.D.n..> ..$...\G|
17 bd 7d 06 95 15 d8 2b  eb fb 29 5a 74 5a 14 cc  |..}....+..)ZtZ..|
35 b0 0f f7 10 6a fe 04  5c 3f 99 de c7 0f 78 f2  |5....j..\?....x.|
3d 4a ce 3d ba 67 b5 49  e1 6f 89 db 0e 91 3e ce  |=J.=.g.I.o....>.|
56 62 38 54 40 26 f5 46  81 ce 32 99 95 88 37 22  |Vb8T@&.F..2...7"|
96 8b 16 d0 09 fe 7c 7e  94 a3 43 7b d6 23 1b 75  |......|~..C{.#.u|
d0 a5 52 eb 8f 1a 13 3e  99 c9 b2 13 c1 a4 60 9e  |..R....>......`.|
e1 e7 c3 93 2c fb ea ab  82 bc 0e ae 8b 7b 04 57  |....,........{.W|
84 78 80 7a 6a 9d e6 d5  85 2d 47 6a 07 4a 5e 49  |.x.zj....-Gj.J^I|
9f 78 aa a9 d1 73 68 45  ed 8f 07 40 6c fc f3 1f  |.x...shE...@l...|
96 91 c6 8e 40 80 a7 0b  eb aa fb 16 aa d4 40 14  |....@.........@.|
98 8a 03 0d ad ea 7a 53  e0 a7 ad cf 3b 7b 8c 86  |......zS....;{..|
6f 54 0e 8d 07 04 ae f0  34 24 46 5d 70 12 b8 07  |oT......4$F]p...|
54 9e e6 0d f5 60 cd 71  23 43 67 4e c1 41 92 62  |T....`.q#CgN.A.b|
b9 df 26 2e b6 5f 7a ac  0e 36 7a 5e 21 47 1f bb  |..&.._z..6z^!G..|
a1 6b 56 ca e4 c2 b2 d1  c6 54 7c 85 49 89 6f 16  |.kV......T|.I.o.|
67 81 be fc 4c 3b 2c f8  67 a9 53 09 8b 28 ee 64  |g...L;,.g.S..(.d|
13 db 35 ba b9 f6 9b b6  1d 03 98 0d 23 86 b0 1b  |..5.........#...|
aa bd 6d d9 c7 35 0b a5  77 01 6f a1 02 e2 45 c1  |..m..5..w.o...E.|
7f 0a c9 28 36 d3 22 79  3d 28 4d d5 a2 5e 85 fe  |...(6."y=(M..^..|
7d 4c ab f6 2f 60 7f 91  37 6f d0 43 d8 94 e6 2c  |}L../`..7o.C...,|
7f c9 41 30 22 a6 02 86  83 d2 8d 22 1f 27 c4 e2  |..A0"......".'..|
9b 97 d6 de 8a 43 98 36  64 df 5e d7 6a d0 b8 8f  |.....C.6d.^.j...|
72 a1 a8 44 c6 af 19 5c  8e 46 33 87 f4 70 65 fc  |r..D...\.F3..pe.|
04 bf 30 6a 65 d6 88 1d  7d 6c 62 22 93 9f c7 e9  |..0je...}lb"....|
f9 c7 f5 ab 74 21 6d 92  41 78 f9 73 03 3b 85 15  |....t!m.Ax.s.;..|
7b 98 dd 4b 52 09 a3 63  4b e5 0b b5 37 7a c0 ce  |{..KR..cK...7z..|
7c ac fe 7e 7d a5 a6 4e  43 13 01 a1 ac f9 66 09  ||..~}..NC.....f.|
8a a9 69 84 e3 bc 64 bb  54 d1 6b 7c b9 d0 f8 e6  |..i...d.T.k|....|
23 70 7f 2b 37 d6 8f 4d  fe 76 ce a6 5a 98 ea 4b  |#p.+7..M.v..Z..K|
fd ae be 6d b4 c7 6a 6d  67 68 f8 b1 06 85 e5 6b  |...m..jmgh.....k|
dd 69 95 f3 7c c5 99 df  24 b2 4b 69 78 72 1e de  |.i..|...$.Kixr..|
64 15 af 32 5f 73 75 d1  14 16 8e 67 09 f0 a2 ac  |d..2_su....g....|
dd a0 c6 6e ad 75 d6 e9  25 91 42 24 f4 d9 2c de  |...n.u..%.B$..,.|
13 83 73 54 86 fe 6b d7  af 7a ea 03 b4 dd 6e 0e  |..sT..k..z....n.|
19 53 f9 84 2c 60 01 63  ba 8a 64 e4 44 13 e5 76  |.S..,`.c..d.D..v|
22 50 a0 a5 ce 9b 58 80  55 6c af bb 7d 09 ab 06  |"P....X.Ul..}...|
4a 73 f9 72 5e ef 73 5a  5f cd c5 90 de 56 40 6a  |Js.r^.sZ_....V@j|
eb 85 37 4d 5f ee e7 63  60 f1 64 1e 5f 28 61 a1  |..7M_..c`.d._(a.|
ee a6 76 4b 30 06 ad 6c  d0 3d 5f db be 51 d3 8c  |..vK0..l.=_..Q..|
93 64 17 c8 65 14 6c aa  f1 c8 72 0d 55 60 3a fd  |.d..e.l...r.U`:.|
49 46 83 75 8f f4 52 cf  94 70 0d 52 64 26 5e 48  |IF.u..R..p.Rd&^H|
fa e0 85 68 12 98 dc 14  ef 62 a7 ba e3 cd 85 cf  |...h.....b......|
df e0 17 a9 ee 07 2c 4b  6f 30 8f d2 54 68 bf 1a  |......,Ko0..Th..|
4b a0 2d 4d 99 fd 52 72  03 61 b8 b1 8e 7f 36 5e  |K.-M..Rr.a....6^|
fc 36 8d 76 44 76 25 3d  6e fb 0c 8f 14 a2 7e 93  |.6.vDv%=n.....~.|
70 80 9a f0 34 3a 0b aa  99 1f 3a ce 5f f7 63 04  |p...4:....:._.c.|
ad 3c a5 3c 8b 73 cd 93  5f 87 09 90 b0 50 41 d9  |.<.<.s.._....PA.|
9a 0f 3f 1f 9f 39 e8 b8  62 a7 a6 c1 64 2f 48 30  |..?..9..b...d/H0|
46 1d 04 33 43 22 d9 54  d6 b6 f4 af ba e2 d5 a5  |F..3C".T........|
bd 91 f0 f6 9b d6 72 2b  d4 3d 5d 90 af 8e 42 e6  |......r+.=]...B.|
5a 36 ae 62 6d 9b a2 97  2b 26 9e 9b c4 3f ae c4  |Z6.bm...+&...?..|
12 7e 68 6d 6d 66 cf a1  29 52 9f 92 55 f5 d5 3f  |.~hmmf..)R..U..?|
c5 19 92 29 11 6a 21 09  f6 a4 bb 57 e5 3f dd 98  |...).j!....W.?..|
93 80 43 49 dd ac cf 55  5d 11 94 76 f0 b9 28 64  |..CI...U]..v..(d|
a6 8a fc 38 39 10 f6 69  99 32 e2 3a 3a 2f 1f 17  |...89..i.2.::/..|
03 77 03 26 b8 e4 e3 8f  30 55 46 ba 9e 1e 86 95  |.w.&....0UF.....|
dd 05 23 97 f2 7e 67 0c  b7 87 92 6d e1 cf 4d 48  |..#..~g....m..MH|
e4 78 0d f4 4f 3d 24 ad  a9 2f 23 b5 01 e0 5d 26  |.x..O=$../#...]&|
13 35 9c 9e 53 9f 5c 5b  36 8f 2a 71 80 d6 6a 49  |.5..S.\[6.*q..jI|
ff c9 aa f8 f5 56 47 23  91 e2 7d 0f bc 30 c1 fc  |.....VG#..}..0..|
30 fd 63 fb ee cf de d0  c2 66 6d 98 bc 6d 1b 4c  |0.c......fm..m.L|
e1 66 8a 49 06 47 2e 75  75 6a 8d c5 fc 2d 69 95  |.f.I.G.uuj...-i.|
62 73 56 32 e1 5c 21 7e  4a e0 06 89 c3 31 a8 96  |bsV2.\!~J....1..|
d8 7f 3c d1 da 1b 58 bf  a5 71 6a a7 6e 71 2f 7f  |..<...X..qj.nq/.|
9b 60 3b 16 c9 0c f5 87  ff 84 ff be c3 b0 fd 01  |.`;.............|
fa 77 35 53 56 cc ec af  37 d7 95 5b c2 07 92 5e  |.w5SV...7..[...^|
93 41 38 52 4a 96 d4 26  dc 8c cb 08 71 73 ae 79  |.A8RJ..&....qs.y|
1f 66 d0 60 dc 51 36 07  85 34 ee d9 2f ec b5 e8  |.f.`.Q6..4../...|
c3 48 d8 e2 88 26 da a4  1b 66 3d 86 83 f0 6e 01  |.H...&...f=...n.|
62 96 4a e1 56 0e 20 9c  ab cc be ee ee 96 df 69  |b.J.V. ........i|
e9 da 0c 1b b0 dc c6 64  39 35 8d b1 b6 18 16 ab  |.......d95......|
a4 88 44 92 af da be da  8a 1f 2e 3c 3e e9 fb 40  |..D........<>..@|
88 12 a6 a0 ef 4d 7d 59  7a 4f 59 55 ca c6 a2 24  |.....M}YzOYU...$|
89 ef 44 83 5b 88 47 c0  c8 5c cc 35 de c2 19 61  |..D.[.G..\.5...a|
e5 3b 5e ec 7a 80 85 0c  e7 bf 1f 0f 02 d5 b5 27  |.;^.z..........'|
79 b4 33 17 4a d7 93 5f  4e e7 0c a3 96 70 e9 53  |y.3.J.._N....p.S|
0c 59 ce 4e 07 f1 8c 97  c9 44 c4 51 25 0b 13 86  |.Y.N.....D.Q%...|
a1 71 5d 85 79 ff 21 dc  4a 5a c2 a4 2f 35 c5 b1  |.q].y.!.JZ../5..|
49 a0 f7 65 ce 91 62 ae  b1 cf 92 e4 fe a5 a3 a6  |I..e..b.........|
ef 75 76 5b 62 28 92 74  aa 80 ab a8 76 c8 a7 2a  |.uv[b(.t....v..*|
2f 7a 3e 2a 90 c3 f8 13  f1 89 b5 62 60 55 f5 02  |/z>*.......b`U..|
1b c5 92 f7 86 72 ac f4  a6 db 63 74 be d5 2d 03  |.....r....ct..-.|
14 06 66 63 11 60 e9 1e  a0 4b bc b9 9b 3f 38 a4  |..fc.`...K...?8.|
99 97 2b 0e ea ec da bd  b7 1f 6e 9f db fb 1b 90  |..+.......n.....|
93 13 9e 31 94 33 70 3c  1a 23 9d ad 89 7d 42 30  |...1.3p<.#...}B0|
a7 59 9d a7 19 a0 aa c8  1b 35 b3 98 29 cc 56 bf  |.Y.......5..).V.|
09 a7 f3 83 66 7d 6c ec  fd d4 af d4 06 1c 0a da  |....f}l.........|
c5 28 ab 1e 9b 85 cc 1e  4f b8 fa 9f 83 51 6b 0f  |.(......O....Qk.|
99 fd db 22 d5 f0 e2 46  2e 56 30 19 ee 1c af eb  |..."...F.V0.....|
39 d8 7b a2 84 8a 97 5c  1d f9 74 c9 4c 83 08 92  |9.{....\..t.L...|
28 82 2d 25 b4 b7 f9 ee  d2 51 bf 3a a8 f3 f0 c3  |(.-%.....Q.:....|
08 f1 94 b7 e7 12 86 b5  0b 7e b1 7f e9 51 ff f0  |.........~...Q..|
62 57 22 7b da ed fe 23  d5 26 e1 cb 9c 8a 35 50  |bW"{...#.&....5P|
fe af e4 b7 de 71 35 71  e7 fe aa fc c5 20 4a e5  |.....q5q..... J.|
34 d2 5a e6 22 a1 60 34  e7 65 fe 32 b3 bd 04 19  |4.Z.".`4.e.2....|
30 02 3f 4b 85 f2 e7 e8  c3 67 b7 d4 cd 45 81 40  |0.?K.....g...E.@|
cf fb da 7c e8 58 34 06  7a d6 63 2a 60 de 0b 36  |...|.X4.z.c*`..6|
ed 8b 57 74 fc d4 82 0b  73 d7 18 69 72 0c 64 e3  |..Wt....s..ir.d.|
2c 93 89 a6 92 8a 30 10  46 f3 40 c2 14 33 9a 56  |,.....0.F.@..3.V|
cf a3 47 86 6a 49 0f d8  12 26 6f 75 2b 33 d4 48  |..G.jI...&ou+3.H|
83 88 b2 22 05 22 b1 df  46 6c 2b dc c6 f2 a7 38  |..."."..Fl+....8|
33 d7 0d a8 75 75 3d 69  7a d9 c1 84 ef 6f db f6  |3...uu=iz....o..|
53 02 05 81 2b 01 b8 15  39 a2 99 b0 f4 cc 4b b4  |S...+...9.....K.|
b7 65 89 57 4a 74 5d 67  cf af 7b 77 bf e5 24 90  |.e.WJt]g..{w..$.|
5e d8 15 aa f3 7a e7 63  22 2d 69 c8 9e df 42 b1  |^....z.c"-i...B.|
43 40 01 61 1c 52 e5 11  f5 98 6a 84 9a b2 fa c9  |C@.a.R....j.....|
2b 1a 58 57 d1 57 08 93  c7 d4 5b 04 c5 41 6d 2e  |+.XW.W....[..Am.|
7a 11 1f 6c 1c 94 70 38  16 b8 c0 b2 08 64 d3 66  |z..l..p8.....d.f|
81 88 ab 95 3c 53 84 03  36 1b 13 15 f2 fa d1 ba  |.....PZ.^..|
d4 85 a1 12 bd 93 58 82  fd 3f 34 64 4a 1a b1 e4  |......X..?4dJ...|
e8 9c b8 a0 5f fc 23 4e  6e 77 f5 6d 26 eb 1a ef  |...._.#Nnw.m&...|
7b f4 25 a1 8c 59 92 63  96 06 6c e6 c9 65 d0 7d  |{.%..Y.c..l..e.}|
e9 40 57 b9 7b 95 2b 6a  64 f9 74 2b 44 ec 63 9f  |.@W.{.+jd.t+D.c.|
e4 c9 ed 01 86 3b 94 22  79 c2 43 96 ab 52 27 8c  |.....;."y.C..R'.|
b2 8a 85 18 76 81 65 76  7b c2 b0 8c ef 5e 0b a5  |....v.ev{....^..|
8a 35 87 30 d5 e2 f8 0a  62 e1 0d 94 a7 5d e9 92  |.5.0....b....]..|
de 49 fe 23 bb 26 3e 4a  ce 19 6e dd 62 34 d6 4b  |.I.#.&>J..n.b4.K|
ac 1e e0 7e a1 72 02 7c  52 07 02 58 f8 70 71 26  |...~.r.|R..X.pq&|
4e f9 e4 96 34 dd 47 cf  c1 7a d9 40 5a d5 31 ef  |N...4.G..z.@Z.1.|
ca 1c 4e 93 1c fc 12 ec  09 08 be 2d 5f ee ba 71  |..N........-_..q|
26 d0 3e 83 53 f5 b7 05  f7 17 01 a7 98 1e aa 07  |&.>.S...........|
2e 7e 85 68 f5 0c b1 e3  11 f0 44 b1 9e ac e6 2e  |.~.h......D.....|
4e 36 73 cb 0d 31 e8 fc  5a d3 55 5d 63 da 73 18  |N6s..1..Z.U]c.s.|
de 45 23 4b e4 99 0c fc  32 fe f6 d8 fe f1 3b 31  |.E#K....2.....;1|
72 44 d0 28 59 c5 58 5c  97 c7 ae fd 83 d0 64 3d  |rD.(Y.X\......d=|
aa a6 26 5c a6 16 71 6a  fe a4 9d e7 4b fd 9f de  |..&\..qj....K...|
83 4b 0a 25 36 db a8 de  20 c1 47 7b c7 37 77 a8  |.K.%6... .G{.7w.|
a4 8b f2 13 76 66 d5 6e  c8 0a e5 fa d3 ff a1 2f  |....vf.n......./|
b4 cd b3 21 a3 94 20 53  28 bf 3c 19              |...!.. S(.<.    |
module_nameEEXOMI LDR.exe
flags0
timestamp2106-02-07 06:28:15
version0.0
ordinal_base1
nFunctions90
nNames90
Names(90)0xa25e44
Functions(90)0xa25c28
NameOrdinals(90)0xa25d90
offsetsizetypecomment
15c115HTM#
15d09799216BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find file_offset of VA 0x175ce8